test: cover three unit-tested-by-nobody modules (#2464)

`GoRouteGroupScope`, `JSObjectConfigExtractor` and
`NoirAIContext::SourceReader` had no direct unit spec — not one
reference anywhere under `spec/`. All three are pure, deterministic
logic sitting under decisions that matter:

* `GoRouteGroupScope` resolves which URL prefix a Go middleware
  registration guards. `go_auth` and `go_security` both build their
  guarded-prefix list from it, so a wrong answer is a security-tag
  false positive. The specs pin the behaviours the module's header
  comment says it exists for: sibling assignment groups staying
  independent rather than accumulating into `/api/admin`, a
  non-literal group path resolving to `Unknown` rather than
  collapsing to `Global`, and a line that is both a closure and an
  assignment group not folding its prefix in twice.

* `SourceReader` extracts the snippets the AI context is built from.
  Its character budget is load-bearing — a snippet truncated before
  the suppressing evidence turns into a false positive downstream —
  so the specs cover the budget and the block-boundary walk across
  all four styles (brace / python / ruby / bare statement), including
  the decorator lead-in and the indent guard behind the django
  `/public/` false positive.

* `JSObjectConfigExtractor` decodes Payload CMS and Strapi configs.
  The specs cover each declaration shape its header comment claims
  to handle, the value decoder, and the depth guards.

`code_locator.cr` referenced `NoirLogger` and `any_to_bool` without
requiring either; it compiled only because every real entry point
happens to require `logger.cr` first. Requiring a file's own
dependencies is what makes anything downstream of it unit-testable in
isolation — without it `require`-ing `source_reader.cr` alone fails to
compile.

125 new examples. Full unit + functional suites and `just check` pass.

Author: hahwul